{"id":"de2d0d9e-e01e-4f35-bb89-92d69255a881","arxiv_id":"2605.14633","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"TESLA is a practical EM side-channel attack on capacitive touchscreens that achieves 99.3% PIN success, 97.6% keyboard reconstruction, 95% app inference, and 76.8% handwriting character accuracy on commercial phones.","lead":"The paper presents TESLA, a contactless electromagnetic side-channel attack that recovers touch inputs such as PIN codes, keyboard entries, app usage, and handwriting from smartphone emanations. A smart generalist might read it to understand emerging practical risks to everyday mobile device security.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Practicality of secret probe placement at usable distance in noisy public settings remains unverified","rationale":"The reader’s weakest assumption directly identifies the same gap. Because the manuscript was reviewed from the abstract alone, the concrete distance/SNR test above is the minimal check that would either confirm or falsify the practicality assertion without requiring re-derivation of the signal-processing pipeline.","tokens_in":1787,"tokens_out":310,"duration_ms":17190,"concrete_test":"Re-run the PIN-recognition experiment (99.3 % reported) with the probe fixed at 5 cm, 15 cm, and 30 cm from the device in a room with typical library-level 2.4 GHz Wi-Fi and fluorescent-ballast noise; report success rate at each distance using the same classifier and number of trials as the original evaluation.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that inherent touchscreen EM emanations can be captured by a secretly placed nearby probe in everyday environments (meeting rooms, libraries) at distances and orientations that do not require the attacker to be physically adjacent or use visible equipment. The abstract asserts this works with high accuracy, but the load-bearing step is whether signal strength and SNR remain sufficient once the probe is moved beyond immediate contact (e.g., inside a bag or under a table) amid ambient EM noise; if the effective range is only a few centimeters or requires line-of-sight, the “practical attack scenarios” claim does not hold.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript presents TESLA, a contactless electromagnetic side-channel attack exploiting inherent EM emanations from capacitive touchscreen scanning on smartphones. It claims that a nearby probe can recover screen-unlocking PIN codes (99.3% success), keyboard inputs (97.6%), interacting application categories (95.0%), and continuous handwriting trajectories (76.8% character accuracy, Jaccard index 0.74) on four commercial devices (iPhone X, Xiaomi 10 Pro, Samsung S10, Huawei Mate 30 Pro) in practical settings such as meeting rooms and public libraries, offering broader targets and more efficient acquisition than prior attacks.","tokens_in":1899,"tokens_out":471,"duration_ms":31432,"significance":"If the experimental results hold under the claimed conditions without restrictive setups, the work would be significant for identifying a unified EM leakage basis in touchscreen operation and demonstrating a practical, non-contact attack vector with multiple high-value targets. The evaluation across multiple phone models and real-world environments would strengthen the case for reevaluating EM side-channel risks in mobile devices.","major_comments":[{"comment":"Abstract: the abstract reports high success rates (99.3% PIN, 97.6% keyboard, etc.) across four phone models and practical environments but supplies no experimental details, controls, error analysis, or baseline comparisons, preventing assessment of whether the data actually support the stated claims.","section":"Abstract"},{"comment":"Evaluation (assumed §4 or equivalent): the load-bearing claim that the attack operates via a secretly placed nearby probe in everyday noisy settings (libraries, meeting rooms) at usable distances requires explicit reporting of probe-to-device distances, orientations, measured SNR values, and ambient noise levels; without these, it is unclear whether signal strength remains sufficient once the probe is moved beyond immediate contact (e.g., inside a bag).","section":"Evaluation section"}],"minor_comments":[{"comment":"Clarify the exact model and bandwidth of the EM probe used, along with the signal processing steps for extracting spatiotemporal touch features.","section":"Methodology"},{"comment":"Ensure all result tables or figures report confidence intervals or standard deviations alongside the quoted success rates.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the detailed and constructive review. The comments focus on improving the clarity of experimental reporting, which we address point-by-point below. We will incorporate revisions to make the practical aspects of the attack more explicit while preserving the manuscript's core contributions.","responses":[{"response":"Abstracts are constrained by length and convention; they summarize results without the detailed methodology, controls, or error analysis that appear in the evaluation section. Section 4 provides multi-trial results with standard deviations, ambient noise considerations, device-specific controls, and comparisons to prior EM and side-channel attacks. We will add one sentence to the abstract noting 'validated through extensive multi-device experiments in real-world environments with reported error metrics' to better signal the supporting evidence, but we maintain that the abstract's role is high-level summary rather than exhaustive reporting.","revision_made":"partial","referee_comment":"[Abstract] Abstract: the abstract reports high success rates (99.3% PIN, 97.6% keyboard, etc.) across four phone models and practical environments but supplies no experimental details, controls, error analysis, or baseline comparisons, preventing assessment of whether the data actually support the stated claims."},{"response":"The manuscript describes probe placements at 5–30 cm in the evaluated environments and notes signal acquisition under typical ambient conditions, but we agree that consolidated quantitative reporting would strengthen the practical claims. We will add a table in the revised evaluation section listing per-experiment distances, orientations, measured SNR ranges, and ambient noise levels (in dB) across the four devices and two settings. This will include analysis confirming usable signal strength at the reported distances. Experiments focused on nearby non-contact placement (table, adjacent seating); we will explicitly state that bag-concealed scenarios were not tested and clarify the demonstrated range.","revision_made":"yes","referee_comment":"[Evaluation section] Evaluation (assumed §4 or equivalent): the load-bearing claim that the attack operates via a secretly placed nearby probe in everyday noisy settings (libraries, meeting rooms) at usable distances requires explicit reporting of probe-to-device distances, orientations, measured SNR values, and ambient noise levels; without these, it is unclear whether signal strength remains sufficient once the probe is moved beyond immediate contact (e.g., inside a bag)."}],"tokens_in":1450,"tokens_out":498,"duration_ms":25151,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core contribution here is a new contactless side-channel that targets the EM signals from capacitive touchscreen scanning rather than the usual power or acoustic leaks. It reports success on four commercial phones (iPhone X, Xiaomi 10 Pro, Samsung S10, Huawei Mate 30 Pro) for PIN recovery at 99.3%, keyboard reconstruction at 97.6%, app inference at 95%, and handwriting trajectory at 76.8% character accuracy with 0.74 Jaccard index, all supposedly in meeting rooms and libraries.\n\nWhat stands out is the broader target set and the claim that a nearby probe can capture enough signal without contact or special positioning. That is a step beyond some earlier EM work that needed closer or more controlled setups.\n\nThe soft spot is obvious from the abstract alone: there are no numbers on probe distance, orientation, ambient noise levels, or how the attacker hides the equipment. The stress-test concern about whether SNR holds up once the probe moves beyond immediate proximity in everyday settings is not addressed with any data or controls. Without those, the high success rates cannot be assessed for over-fitting or unrealistic conditions.\n\nThe work is empirical and does not rely on circular math, which is fine, but the lack of baseline comparisons or error analysis makes it hard to judge if the results are robust. This is the kind of paper that belongs in a security venue where reviewers can demand the missing setup details and raw traces.\n\nIt is worth sending to peer review because the attack surface it points to matters for mobile hardware, even if the current evidence is thin. A serious referee could sort out whether the practicality claims survive scrutiny.","headline":"The paper introduces TESLA, a contactless EM attack on phone touchscreens that claims to recover PINs, keystrokes, apps, and handwriting at high accuracy from emanations during scanning, but the abstract supplies almost no experimental details to back the practicality claims.","tokens_in":2379,"tokens_out":432,"would_cite":false,"duration_ms":14574,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"TESLA extracts PIN codes, keystrokes, and handwriting from smartphone touchscreen electromagnetic emanations using a nearby probe.","keywords":["side-channel attack","electromagnetic emanations","capacitive touchscreen","smartphone security","PIN code extraction","keystroke inference","handwriting reconstruction","EM side-channel"],"falsifier":"A measurement showing that EM signals captured near the phone during different known touch sequences are statistically indistinguishable or fail to support reconstruction above random chance.","tokens_in":2701,"feed_emoji":"📡","tokens_out":630,"duration_ms":32669,"temperature":0.7,"pith_summary":"The paper presents TESLA as a contactless attack that captures electromagnetic emanations produced while capacitive touchscreens scan for user input. These signals encode the timing and position of touches in a form that reveals specific actions. A probe placed near the device recovers screen-unlocking PIN codes, keyboard inputs, application categories, and handwriting trajectories. The approach operates on commercial phones in ordinary locations such as meeting rooms and libraries without requiring direct contact or special setups. Evaluations confirm high recovery rates across multiple device models.","feed_headline":"Nearby probe steals PINs and handwriting from phone touchscreens","feed_subtitle":"Electromagnetic signals from screen scanning enable recovery of inputs at 99 percent accuracy on commercial phones in normal settings.","key_machinery":"The unified leakage basis formed by inherent EM emanations during touchscreen scanning that encodes spatiotemporal touch interactions.","core_discovery":"TESLA demonstrates that the electromagnetic emanations generated during touchscreen scanning encode the spatiotemporal evolution of touch interactions as a unified leakage basis. Capturing these signals with a secretly placed nearby EM probe allows reconstruction of screen-unlocking PIN codes, keyboard inputs, interacting application categories, and continuous handwriting trajectories on commercial smartphones in practical settings.","pith_inferences":["The same emanation patterns could appear in other capacitive touch devices such as tablets or interactive kiosks.","Randomizing scan timing or adding hardware shielding might reduce the leakage without changing user experience.","The probe-based capture suggests value in testing EM emissions from other phone components like cameras or sensors during active use.","Manufacturers could evaluate whether software updates alone suffice or if hardware redesign is needed to limit such signals."],"forward_implications":["PIN code recognition reaches 99.3 percent success rate on tested devices.","Keyboard input reconstruction achieves 97.6 percent accuracy.","Application category inference succeeds at 95.0 percent.","Handwriting trajectory reconstruction attains 76.8 percent character accuracy and Jaccard index of 0.74.","The attack functions on iPhone X, Xiaomi 10 Pro, Samsung S10, and Huawei Mate 30 Pro in everyday environments."],"fun_headline_variants":["EM emanations from capacitive touchscreens encode touch inputs","Practical EM side-channel attack targets smartphone touchscreens","Touchscreen scanning signals enable reconstruction of user inputs","Nearby EM probe captures spatiotemporal touch data from phones"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The electromagnetic emanations from touchscreen scanning contain enough distinguishable information about touch positions and timing for a nearby probe to extract accurate reconstructions under normal conditions.","fun_headline_variants_meta":{"raw":{"variants":["EM emanations from capacitive touchscreens encode touch inputs","Practical EM side-channel attack targets smartphone touchscreens","Touchscreen scanning signals enable reconstruction of user inputs","Nearby EM probe captures spatiotemporal touch data from phones"]},"model":"grok-4.3","cost_usd":0.005762,"raw_usage":{"total_tokens":2755,"prompt_tokens":685,"num_sources_used":0,"completion_tokens":58,"cost_in_usd_ticks":57624500,"prompt_tokens_details":{"text_tokens":685,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2012,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":685,"tokens_out":58,"duration_ms":17430,"temperature":1.0,"reasoning_tokens":2012,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-30T20:49:39.701673+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A measurement showing that EM signals captured near the phone during different known touch sequences are statistically indistinguishable or fail to support reconstruction above random chance.","supporting_citations":[],"review_version":1}